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In elaborating on the multiple-photon absorption attack on Ekert protocol proposed in 
[arXiv: 10 11.4740, we show that it can be used in other entanglement-based protocols, in partic- 
ular the BBM92 protocol. In this attack, the eavesdropper (Eve) is assumed to be in control of 
the source, and she sends pulses correlated in polarization (but not entangled) containing several 
photons at frequencies for which only multiple-photon absorptions are possible in Alice's and Bob's 
detectors. Whenever the photons stemming from one pulse are dispatched in such a way that the 
number of photons is insufficient to trigger a multiple-photon absorption in either channel, the pulse 
remains undetected. We show that this simple feature is enough to reproduce the type of statis- 
tics on the detected pulses that are considered as indicating a secure quantum key distribution, 
even though the source is actually a mixture of separable states. The violation of Bell inequalities 
measured by Alice and Bob increases with the order of the multiple-photon absorption that Eve 
can drive into their detectors, while the measured quantum bit error rate decreases as a function 
of the same variable. We show that the attack can be successful even in the simplest case of a 
two-photon absorption or three-photon absorption attack, and we discuss possible count ermeasures, 
in particular the use of a fair sampling test. 



INTRODUCTION 

Quantum key distribution [1] aims at preventing an 
eavesdropper (Eve) to acquire any information on a key 
distributed to two parties (Alice and Bob) who wish to 
use it to securely encrypt their communication through 
a public channel. In the ideal case, the secrecy of the 
key relies on two powerful theorems that are at the heart 
of Quantum Mechanics: the no-cloning theorem, which 
prevents an eavesdropper to clone an unknown quantum 
state, and Bell's theorem [2], which guarantees that no 
local information actually exists which an eavesdropper 
could acquire. In actual implementations of the proto- 
cols, the imperfections of the components used to gen- 
erate the key can be exploited by Eve to extract some 
information about it [3]. 

Here, we elaborate on the multiple-photon absorption 
attack on Ekert protocol [4] proposed by Adenier et al 
[HI, and show that the attack can also be successful 
against other entanglement-based quantum key distribu- 
tion (QKD) protocols, in particular the BBM92 protocol 
[6] . We will detail the performances of the attack against 
both Ekert and BBM92 protocols, as well as the possible 
countermeasures available to Alice and Bob. 

In both Ekert and BBM92 protocols, Alice and Bob 
are randomly performing measurements on a small set of 
bases (see Fig.[T]). The idea it to generate a shared key by 
exploiting the perfect correlation of entangled states [7| 
whenever the measurements are performed in the same 
basis. In the BBM92 protocol [6] the secrecy of the key 
is guaranteed by a low enough quantum bit error rate 
(QBER). In the Ekert protocol, it is guaranteed in ad- 
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FIG. 1. Entanglement-based Quantum Cryptography. Al- 
ice and Bob randomly switch their measurement settings. In 
Ekert protocol, three settings are used on each sides. Oa — 
{0, f , f } for Alice, and = {0, - f , f } for Bob. Detections 
associated with identical measurement settings (^a = ^b) are 
used to produce a correlated key, while those associated to 
non-identical measurement settings (^a / ^b) are used to 
check the violation of Bell inequality (and the security of the 
key). In the BBM92 protocol, Alice and Bob use two diagonal 
bases only: Oa = {0, f } for Alice, and Ob = {0, f } for Bob 
as well. The detections associated with identical measure- 
ment settings (^a = ^b) are used to produce the key, while 
its security is guaranteed by a low enough QBER. 



dition by a sufficiently large violation of Bell inequalities 
[1, H, [l6l - [l8| measured for non-identical measurements, 
which allows in principle for device-independent quan- 
tum key distribution (DIQKD) pj|,l20|. 

We consider an entanglement-based QKD in which the 
source is operated midway between Alice and Bob (see 
Fig.[T]). This type of configuration allows for higher losses 
in optical fibers [2l|,[22[, or for truly large distances in free 
sj)ace with a source located onboard an orbiting satellite 
[23|,l2J]. The source should therefore be considered to be 
in a location untrusted by Alice and Bob, and we will 
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in fact assume throughout this paper that Eve is in fuh 
control of it. 



MULTIPLE-PHOTON ABSORPTION ATTACK 

Eve's multiple-photon absorption attack [sj consists of 
replacing the source of entangled photons altogether by 
a controlled source of separable states (see Fig.[2j). Eve's 
purpose is to let Alice and Bob convince themselves that 
the secrecy of the key that they extract with this source 
is guaranteed by the laws of Quantum Mechanics, while 
in fact Eve has a full knowledge of the local states sent 
to them both, and a fairly good knowledge of the key 
that they generate with this source. As we will see, it 
does not matter which of the Ekert or BBM92 protocols 
is implemented by Alice and Bob. The attack works in 
all cases by mimicking the statistics of an entangled state 
well enough to pass the security checks normally under- 
taken by Alice and Bob: it exhibits a high violation of 
Bell inequalities and a low QBER. 

The attack works as follows; Eve sends pulses contain- 
ing photons that can each be represented by a local po- 
larization state I A), and she sets their frequency such that 
the only way to get a click in a detector is when all the 
photons from a pulse are absorbed in one same detector, 
through a multiple-photon absorption [25|. To simplify 
the discussion and highlight the principle of the attack, 
we assume that Eve can control precisely the number of 
photons in each pulse, their polarization and their fre- 
quency. Eve sends n-photon pulses to Alice, the photons 
having a frequency Un such that only an n-photon ab- 
sorption is possible in Alice's detectors, and she sends 
m-photon pulses to Bob, the photons having a frequency 
Um such that only an m-photon absorption is possible in 
Bob's detectors. As we will see, this simple attack is suf- 
ficient to get a high enough violation of Bell inequalities 
and a low enough QBER as soon as n > 1 or m > 1. 



Single-photon absorption attack 

In this first attempt. Eve is trying to approach as best 
as she can the predictions of Quantum Mechanics for a 
singlet state, but using only a mixture of separable states, 
in a single-photon absorption scenario. She is therefore 
sending pulses such that n = m = 1, at a frequency 
ui where the dominant absorption is a standard single- 
photon absorption (see Fig.[3]-a). She will not succeed in 
getting a violation of Bell inequalities or a low QBER, but 
this result will serve as a basis to obtain a significantly 
better result in the case of multiple-photon absorption. 

Eve prepares a set of pairs of pulses for Alice and Bob. 
Each pulse contains exactly one photon that is linearly 
polarized in a direction chosen by Eve. It can thus be 
described in its own Hilbert subspace Hi by a two-level 
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FIG. 2. Principle of the Multiple-photon absorption attack. 
Eve sends n-photon pulses to Alice, the photons having a fre- 
quency Un and a polarization |A); and m-photon pulses to 
Bob, the photons having a frequency z^m and a polarization 
I A + Eve chooses the frequency Un such that only an 

n-photon absorption is possible in Alice's detectors, and 
such that only an m-photon absorption is possible in Bob's 
detectors. In the figure, Eve sends 2-photon pulses to Al- 
ice, at a frequency such that a click can occur in Ao and 
Ai only through a two-photon absorption, and she sends 3- 
photon pulses to Bob, at a frequency such that a click can 
occur in Bo and Bi only through a three-photon absorption. 
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FIG. 3. Absorption of photons in the detectors: a) Single- 
photon absorption, b) Two-photon absorption 



state of the form 



\Xi) = cosAi|0) + sin Ai|l), 



(1) 



where |0) and |1) are the eigenvectors of (Jz with eigen- 
values — 1 and +1 respectively. The pair of pulses can 
then be described in the tensor product Hilbert space 
Hi2 = Hi % as |Ai2) = |Ai) IA2). 

Alice and Bob, who are performing local measurements 
respectively in Hi and H2, want to measure the statis- 
tical correlation of the pairs they receive from Eve when 
they perform some rotations R{Oa) and R{Ob) on their 
respective pulses, followed by a measurement of the ob- 
servable (Jz. 

Since Eve wants them to obtain an as good 
(anti) correlation as possible with separable states, she 
sends orthogonal states to Alice and Bob, that is, such 
that Ai = A and A2 = A + and the initial state sent to 
Alice and Bob can be written: 
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For a pair initially represented by this state (j2j), the state 
after local rotations on each sides becomes 

|Aab) = IA + ^a)® IA + I + ^b), (3) 
which can be expanded as 

|Aab) = cos(A + 6>a) cos(A + | + 6>b)|00) 
+ sin(A + 6>a) cos(A + J + 6>b)|10) 

(4) 

+ cos(A + 6>A)sin(A+ I + 6>b)|01) 

+ sin(A + 6>A)sin(A+ I + 6>b)|11), 

Keeping the condition of orthogonality between Alice 
and Bob from pair to pair, Eve is randomizing the pa- 
rameter A associated to each pair. The state of the set 
of pairs prepared by Eve can therefore be described by 
a mixture. We can characterize the probability of ob- 
taining a state between |A) and \X^dX) by a probability 
density distribution p{X) on a single probability space 

The mixture p describing the set of pairs after rotation 
is therefore 

PAB= / p(A)dA |Aab)(Aab|, (5) 
Jn 

with p{X)dX = 1. 

Note that we chose to denote the polarization of the 
pulses prepared by Eve as A, a symbol that is tradition- 
ally reserved to hidden- variables, but this variable is in 
fact hidden only from Alice and Bob, and it is not a hypo- 
thetical supplementary parameters to Quantum Theory. 
By describing the state with mixtures, we adopt here the 
point of view of Alice and Bob. However, the parameter 
A describing the state of each pulse is freely chosen by 
Eve. Thus it can in principle even be deterministic, as a 
function of time. Eve needs only to make sure that there 
is on average no preferred direction for the A so that the 
source is rotationally invariant for Alice and Bob, both 
at the single-count and coincidence-count level. 

After performing their respective rotation on the re- 
ceived pulses, Alice and Bob perform a joint measure- 
ment (Jz (g) <Jz on each pair. The expectation value of this 
measurement is: 

Eab = {^z <S) ^z)pAB = Tr(/3AB^z <S) cr^), (6) 

with (Jz = |0)(0| - |1)(1|, so that 

(Tz ^ = |00)(00| - |10)(10| - |01)(01| + |11)(11|, 

and where Tr is the trace, defined as the sum of the di- 
agonal matrix elements in any ort honor mal basis, which 
in our case is Tr O = Xl]^ j=o(^jl^l^j)' where O is an 
operator in H12. 



By linearity of the trace, we can write 

^AB = ^00 — PlQ — PqI + Al, 

with 

Pki='^r{pAB\kl){kl\), 

where k and / are or 1. 

The Pki are the joint probabilities, and we can now 
express them explicitly, using Eq. (j5j), as 

P^i^y. I pWdX{ij\AAB){AAB\kl){kl\ij), 

which, since {|00), |10), |01), |11)} forms an orthonormal 
basis in H12, simplifies as 

Pki= I p{X)dX\{kl\AAB)\^ • (7) 

Note that, owing to the separability of |Aab) as ex- 
pressed by Eq. (|3]) , we can factorize the integrand in the 
above joint probability into a product, that is, 

Pki= I p(A)dA|(fc|A + ^A)(/|A + 5+^B)|'. (8) 

Denoting the probability to get a photon in a channel 
i for a local state |A) and a measurement direction d as 

P,(A,^) = |{i|A + e)|', (9) 

which is explicitly 

Po(A,^)=cos2(A + ^), 
Pi(A,^) = sin2(A + ^), 

we can rewrite Eq. (j8j) as 

Pu= [ p(A)dAPfc(A,^A)P^(A+5,^B), (11) 

which can be simply interpreted as the integral on all 
possible A of the product of the probability to detect a 
photon in channel k on Alice's side for a local state |A) 
by the probability to get a photon in channel / on Bob's 
side for a local state |A + ^). 

Assuming p(A) is a uniform distribution on the interval 
[0, 27r[, we can then express these integrals explicitly as 
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which leads to 

Poo = Pii = 1(2 - cos2(^A - ^b)), 

I (13) 
Pio = Poi = -(2 + cos2(^A - ^b)), 

and finahy, we get 

^ab = -^cos2(^a-^b). (14) 

This result differs essentially from the prediction for 
the singlet state by its visibility of 1/2 instead of 1. With 
this correlation function, the maximum of the CHSH 
function [8], defined as 

5= |^(^a,^b)+^(^a,^b)+^(^a,^b)-^(^a,^b)I (15) 

is 5* = a/2, which is clearly below 2 and therefore insuf- 
ficient as an attack on Ekert protocol. 

Similarly, this attack fails against the BBM92 protocol. 
The QBER can be estimated [H, |lo| from the visibility V 
as QBER = With V = 1/2, the QBER measured 

by Alice and Bob is as high as 25% in this single-photon 
attack, which Alice and Bob would not fail to reject. 

Two-photon absorption attack 

In the two-photon absorption attack. Eve similarly 
sends pairs of pulses described by a mixture of separa- 
ble states to Alice and Bob, but this time each pulse 
contains two photons instead of one. The photons inside 
a pulse share the same state: |A) for the two photons 
inside the pulse sent to Alice; and |A + |-) for the two 
photons inside the pulse sent to Bob. We assume that 
the photons inside a pulse are independent: each photon 
follows the rules of Quantum Mechanics as prescribed by 
its quantum state independently of what the other pho- 
tons inside the pulse are doing. 

Now, the crucial difference is that these photons are 
chosen by Eve with a frequency U2 lower than in the 
single-photon absorption case discussed above, so that 
the energy of a single photon is insufficient to trigger a 
click. Eve chooses the frequency of the photons such that 
the only way to get a click is through a two-photon ab- 
sorption (see Fig. [3]-b). We assume for simplicity that 
whenever two photons hit the same detector simultane- 
ously, the probability that they trigger a click in the de- 
tector is 1. As we will see, this feature alone is (surpris- 
ingly) enough to lead to a clear violation of Bell inequal- 
ities and a low QBER. 

So, a click occurs in a specific output channel of a po- 
larizing beam-splitter (PBS) only when the two photons 
inside the same pulse choose to exit through that same 
channel. If they choose different channels, no two-photon 
absorption can occur because there is only one photon in 
each channel. On each side, the three possibilities are: 



• Both photons go to channel click in channel 
through a two-photon absorption, 

• Both photons go to channel 1 click in channel 1 
through a two-photon absorption, 

• One photon goes to channel 0, the other goes to 
channel 1 ^ no click in either channel. 

Note that this third possibility brings us in the realm 
of the detection loophole |lll4l5j. It is the essential rea- 
son for the appearance of the violation of Bell inequalities 
that Alice and Bob are going to obtain. It should however 
be stressed that the non detections come from the fre- 
quency threshold in the photoelectric effect alone; a fea- 
ture that is relevant in all detectors based on this effect, 
regardless of their quantum efficiency. Eve is therefore 
working in a fully Quantum Mechanical framework, with- 
out assuming anything about the detectors other than 
the existence of two-photon absorption processes at cer- 
tain frequencies, and without assuming the existence of 
any hidden- variables. 

(2) 

We want to calculate the probabilities P^i ^ that Alice 
and Bob get a coincidence click respectively in channels 
k and / in a two-photon absorption attack. 

Note that whenever it is necessary to avoid possible 
ambiguities, we will label hereafter the equations with 
an upper script (n) or (n, m) indicating the order of the 
multiple-photon attack. For instance the joint proba- 

(2) 

bility P^i is for a two-photon absorption attack, while 

P^^^'^^ is the same probability for a mixed attack in which 
Alice is subjected to a two-photon attack while Bob is 
subjected to a three-photon attack. 

Assuming independence between the photons, for a lo- 
cal state I A) and a measurement angle on either side, 
the probability that both photons from one pulse end up 
in the same channel i is simply the square of the probabil- 
ity Pi (A, 6) to see one such photon exit the PBS through 
this channel z, that is: Pf{\^9) 

So, similarly to what we had in the single photon case 
in Eq. (pT]) . the probability P^^ to get a click in channel 
k for Alice and in channel / for Bob in a two-photon ab- 
sorption process is therefore the integral over all possible 
state of the product of the probability P|(A, Oa) for Alice 
to get a click in channel k by the probability P^^(A+|-, 6>b) 
for Bob to get a click in channel /: 

P^^ = ^P(A)dA P|(A,^a) Pf{\ + \M)- (16) 
For a rotationally invariant source, A is uniformly dis- 
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tributed on the interval [0, 27r[, which leads to: 
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(17) 



and we obtain: 



^00^ = Pu = Yi^(lS - 16cos2(^A - ^b) + cos4(^A - ^b), 
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of Bell inequalities as large as desired within the algebraic 
limit of 4, the only limit being the order of the multiple- 
photon absorptions that Eve can drive into Alice's and 
Bob's detectors. 

Note that if Eve sends pulses meant to drive on one side 
a two-photon absorption and on the other a three-photon 
absorption (a feature that Eve could achieve by alterna- 
tively sending photons of different frequency to Alice and 
Bob), the relevant probabilities for the coincidences are 
of the form 

Pti''^ = ^ p(A)dA P,2(A, ^a) (A + ^,9b) (21) 
which leads to a correlation 



^0?^ = ^'lo^ = 1^(1^ + 16cos2(^A - ^b) + cos4(^A - ^b). 

(18) 

Note that these four probabilities no longer add up 
to 1, because of the cases involving a non detection on 
either side or both, which are discarded by Alice and 
Bob. So, as is standard in optical EPR experiment and in 
entanglement-based QKD with photons, the correlation 



function has to be normalized by the sum ^ P^^ 



(2). 
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AB (2) (2) p(2) p(2) ■ 

^00 ^ -^10 ^ ^01 ^ Ml 



(19) 



We obtain explicitly 



„(2) ^ 16cOs2(gA-gB) 

18 + cos4(6'a -^b)' 

which lead to a violation of Bell inequalities for 6a = 
{0,f}and^B = {-f,f}of 

5(2) = 1^2V2« 2.51, 
18 

which is clearly above 2. 

Here the visibility is 1/ = 0.842, so that a BBM92 
protocol would give a QBER of 7.9%, which is already 
well below the security bound of 11% against coherent 
attacks EH, EH . 



Multiple-photon absorption attack 

A similar demonstration in the case of a three-photon 
absorption, with Eve sending three photons per pulse, 
leads to 



p(3) _ 
-^kl — 



[ p{\)d\PU\,OA)P^\+^,OB) 



(20) 



which exhibits a violation of Bell inequalities as high as 
^ 3.17, and a QBER of 2.1%. Quite generally, a 
multi-photon absorption process can lead to a violation 



^(2,3) ^ 1Qcos2(^a-^b) 
10 + cos4((9a -6>b) 



and a violation of Bell inequalities for ^a = {0, f } and 
Ob = {-f ,f} of exactly 

which is the maximum violation predicted by Quantum 
Mechanics for entangled states. 

In case of a BBM92 protocol, the QBER measured by 
Alice and Bob is 4.5%. This is below the critical QBER of 
7.1% for a device-independent quantum key distribution 
(DIQKD) in which not only the source but also the mea- 
surement devices used by Alice and Bob are untrusted 
[19I . [20! . The reason for this behavior is essentially that 
the detection probability of the pulses is below the 83% 
required to close the detection loophole [l2|, [261. This 
shows the absolute necessity of a loophole-free violation 
of Bell inequalities in a DIQKD scenario 3, ^ . 

The performances of the various multiple-photon ab- 
sorption attacks are summarized in Table HI and the cor- 
responding correlation functions measured by Alice and 
Bob are displayed in Fig. [5l 



Multiple-photon absorption attack as an adaptive 
process 

In order to interpret and explain this seemingly un- 
likely violation of Bell inequalities with a mixture of sep- 
arable states, it is convenient to look locally (e.g. on 
Alice's side) at the probability that a pulse A imping- 
ing on a polarizing beam-splitter gets detected in either 
output channel. 

In the multiple-photon absorption attack, the only way 
to get a click with a pulse containing n photon is through 
an n-photon absorption, so that the probability to get a 
click in an output channel i is equal to the probabil- 
ity that all the photons from a pulse exit through this 
same channel. Assuming the independence of the pho- 
tons, this probability is simply the power n of the prob- 
ability Pi{X^6) of Eq. that a single photon polarized 
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along A goes to channel i. The probability to get a click 
in either output channel for an incoming n-photon pulse 
is therefore: 



a) 



clic 



(Po(A,e))" + (Pi(A,0))" 
cos2"(A + 6') + sin2"(A + 6'). 



(22) 



In the single-photon attack presented in the first sec- 
tion (n = 1), each pulse polarized along A contains one 
photon only, and the probabilities to get a click in either 
channel are adding up to one, that is, P^^^^ = 1, which 
denotes that a photon impinging on a PBS is necessar- 
ily detected in one of the output channels in the ideal 
case. All the single-photon pulses are therefore treated 
on equal footing, independently of the state A and of the 
measurement setting 6>, and this is why this attack fails 
to lead to an observed violation of Bell inequalities. 

By contrast, in the case of a two-photon absorption 
attack, the probability that a pulse containing n photons 
polarized along A gets detected in either channel becomes 



1 



(3 + cos(4(A + 6>)). 



(23) 
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It exhibits a clear dependence on the state of the pulse 
A and the local measurement setting 0. It means that 
the interaction of each pulse A with the measurement ap- 
paratus as a whole (constituted by the polarizing beam- 
splitter and the detectors) depends on the very setting 
of this apparatus: the detection process in the multiple- 
photon absorption attack is state- adaptive [2?). This 
behavior is illustrated in Fig. HJ In the two-photon 
and three-photon absorption attacks, the response of the 
measurement apparatus to incoming pulses is radically 
different when the measurement setting is ^ = than 
when it is ^ = ^ . This behavior is hidden from Alice and 
Bob by the randomness of A from one pair to the other, 
but the consequence is that different parts of the prob- 
ability space are in effect weighted as a function of the 
local context 0. It leads to a bi-local dependence on the 
contexts (^a,^b) when calculating the probabilities asso- 
ciated with the coincidences, and this feature is known 
to open the possibility of a violation of Bell inequalities 
with local states [11, S,!!!. 



Eve's knowledge of the key 

In a multiple-photon absorption attack. Eve has a full 
knowledge of the local states that she sends to Alice and 
Bob. Each pair is characterized by state of the form 
Eq.(j2j), where the polarization A characterizing each pair 
is chosen by Eve. This perfect knowledge of the local 
state sent to Alice and Bob does not however mean that 
Eve has a perfect knowledge of the key that they will 



FIG. 4. Probability of detection of a pulse A in either output 
channel: a) for ^ = 0, b) for — tt/A. In the single-photon 
case, the probability to detect a pulse is identically equal to 
1/2, which denotes a passive response of the measurement ap- 
paratus: all single-photon pulses are treated on equal ground. 
By contrast, in the two-photon and three-photon absorption 
attacks the process is adaptive in the sense that the proba- 
bility that a pulse A gets detected in either channel depends 
strongly on the measurement context encountered. 



generate with these pairs, because of the inherent proba- 
bilistic nature of Quantum predictions whenever one per- 
forms a measurement in another basis than the one in 
which a state was prepared. 

The key is generated in those cases in which Alice 
and Bob are performing identical measurement, that is 
Oa = Ob = 0. Knowing a = |A + ^| for each pulse. Eve 
knows the probabilities for and 1 to be realized on each 
side, and she simply bets for the one that has the higher 
probability. 

Consider the cases for which < |A + ^| < 7r/4. We 
then have cos (A + 6>) > sin^(A + 6>), so that Po{X,0) > 
Pi(A,6>) for Alice and Pi(A + 7r/2, 6>) > Po(A + 7r/2, 6>) for 
Bob. Eve therefore bets that the bit measured by Alice 
is and that the bit measured by Bob is 1. 

Assuming independence between the photons, the 
probability that all the photons from an n— photon pulse 
on Alice's side end up in channel 1, and thus generate a 
click opposite to Eve's guess, is (A,^). Just the same, 
the probability that all the photons from an m— photon 
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pulse on Bob's side end up in channel 0, and thus gen- 
erate a click opposite to Eve's guess, is Pq^{\ + 7r/2,6>). 
The probability that Eve guesses incorrectly a bit shared 
by Alice and Bob when 0<|A + ^|<7r/4is therefore 

P^{\ 0)P^{X + 7t/2, 0) = sin'(^+^) (A + 0). 

Similarly, in the cases for which 7r/4 < |A + ^| < 7r/2, 
the probability that Eve guesses incorrectly is 

P^{X, 0)P^{X + 7r/2, 0) = cos2(^+^) (A + 0). 

The same reasoning can be extended to higher values of 
|A + ^|, leading either to a dependence on sin^^^^^^ (A + ^) 
or cos^^"^+^^(A + ^), so that on average, for a uniform 
distribution of A on the circle, the probability that Eve 
guesses incorrectly a bit shared by Alice and Bob is 

^i™ ^ = I ( da sin'^^+"^) a+ J"^^ da cos'^^+^) a) . 

Note that the pulses for which Eve has the least infor- 
mation are those where cos (A + 6>) ^ sin2^(A + 6>), that 
is |A + 6>| ~ 7r/4 + /c7r/2. It is also for these pulses that 
Alice and Bob are the most likely to not end up with the 
same bit, thus increasing the measured QBER. Unfortu- 
nately for Alice and Bob, as soon as n > 1 or m > 1, it 
is also for these pulses that the probability of detection 
is the smallest for a fixed n and m, as given by Eq. (|22]) . 
Since this probability decreases for higher-order multiple- 
photon absorption, it also means that, rather counter- 
intuitively, the probability Pi^oT^ that Eve makes a mis- 
take guessing a bit shared by Alice and Bob decreases 
with higher violation of Bell inequality and with lower 
QBER (see Table I!]). 

Alice and Bob should therefore be wary not to trust a 
strong violation of Bell inequality and/or a low QBER as 
such, because it might give them the wrong impression 
that the strength of this violation and/or the small num- 
ber of errors in the key make it safe when it is in fact the 
opposite. 



COUNTERMEASURES 
Monitoring the single and coincidence counts 

Detecting Eve's attack by monitoring closely the single 
counts and the coincidence counts is not a trivial task. 

As we have seen, a violation of Bell inequalities or a 
low QBER is not a trustworthy criterion unless the de- 
tection efficiency is higher than the values given in Table 
HI If Alice and Bob were taking into account the non- 
detected pulses to compute the correlation, for instance 
by assigning a random bit value to non-detected pulses 
[19| , they would not get any violation of Bell inequality 



TABLE I. Performances of multiple-photon absorption at- 
tacks, rj is the minimum channel efficiency required to rule 
out each attack; S is the violation of the CHSH inequality 
measured by Alice and Bob; V is the visibility; QBER is the 
quantum bit error rate; and Pir^oT'* is the corresponding prob- 
ability for Eve to incorrectly guess a bit shared by Alice and 
Bob. 



(n,m) 


V 


S 


V 


QBER 


p(n,m) 
-'^error 


(1,1) 


100% 


V2 


0.50 


25% 


5.67% 


(2,2) 


75% 


2.51 


0.84 


7.9% 


0.82% 


(2,3) 


68.75% 


2^2 


0.91 


4.5% 


0.17% 


(3,3) 


62.5% 


3.17 


0.96 


2.1% 


0.14% 




-1.0 L 



FIG. 5. Correlations measured by Alice and Bob depending 
on the order of Eve's multiple-photon absorption attack. An 
important property of this attack is that the correlations mea- 
sured by Alice and Bob are rotationally invariant: they only 
depend on the difference between their measurement angles 
Oa and Ob, and not on their absolute values. It means that 
the attack is basis independent, and that it works indepen- 
dently of which entanglement-based QKD protocol is chosen 
by Alice and Bob. 

with this attack. However, the typical detection efficien- 
cies obtained in actual implementation of QKD protocols 
with photons are far below the bounds given in Table HI 
Eve's attack is therefore relevant because discarding the 
pairs for which no detection is recorded on either side and 
normalizing by the sum of coincidences is the standard 
way of deahng with non-detections. Alice and Bob would 
therefore not be able to distinguish a genuine source of 
entangled photons from this attack by simply observing 
a violation of Bell inequalities. 
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Monitoring the single counts is also unlikely to be- 
tray Eve's attack, because all the channels are treated 
on equal footing by the attack, and the source is rota- 
tionally invariant. The channel efficiencies are therefore 
balanced: the marginals are random for each measure- 
ment, as would be expected from a singlet state. 

In the ideal case, the multiple-photon absorption at- 
tack does not produce any double-counts either that 
could be spotted by Alice and Bob, because a click occurs 
only when all the photons from a pulse exit through the 
same channel. In case of a two-photon absorption attack 
for instance, the only way to get a double-count would 
be with a pulse containing no less than 4 photons, which 
is impossible once we assume that Eve controls the num- 
ber of photons in each pulse. Even if, more realistically. 
Eve had not a tight control on the number n of photons 
inside a pulse, for instance if she was using a weak co- 
herent source for which the distribution of the number 
of photons is Poissonian P(n) = e~^^, a double-count 
would only be possible for pulses containing 4 photons 
or more, which would have a much smaller probability to 
occur than the probability to get a pulse with 2 photons, 
for small enough values of /i. 

Looking at the individual rates of coincidences is also 
unlikely to betray Eve's attack. The predicted rates of 
coincidences and the correlations functions are all rota- 
tionally invariant: they depend only on the angle differ- 
ence I^B — as is the case for a genuine singlet state. 
The attack is basis independent. 

The correlation function differs slightly from the 
— Vcos2(^A — ^b) expected for a singlet state in a lossy 
channel, but this difference is small and in actuality it 
would be difficult to distinguish the correlations obtained 
with a multiple-photon absorption attack from the cor- 
relation predicted for a genuine entangled state with a 
reduced visibility, especially if only a few points of the 
correlation are actually measured, as is the case in an 
entanglement-based QKD protocol. 

An unwanted feature that could betray Eve's presence 
is that the sum of coincidences depends on the measure- 
ment settings and ^b- The stronger the violation of 
Bell inequalities, the stronger the visibility of the sum of 
coincidences. For instance, its visibility is about 0.06 in 
the two-photon absorption case (6''^^^ ^ 2.51), and it is 
0.10 in the mixed case with two-photon absorption on one 
side and three-photon on the other side (5'^2,3) ^ 2^2.). 
However, Eve can remove this unwanted effect entirely 
by driving different detection patterns for Alice and Bob, 
in a similar way to what was done by Larsson [12] and 
Gisin [13] in their hidden-variable models. The simplest 
method would be to alternatively drive a single photon 
absorption on one side, and a multiple-photon absorption 
on the other side. The sampling is then always fair on the 
side driven to a single photon absorption, and the total 
number of coincidences becomes independent of the mea- 
surement angles. It is nevertheless in Alice's and Bob's 



interest to closely monitor the sum of coincidence for any 
such angle dependence, because if it does not guaran- 
tee in principle against this attack, it makes Eve's task 
more difficult by forcing her to use higher order multiple- 
photon absorptions to achieve the same violation of Bell 
inequalities or the same QBER. 



Precluding multiple-photon absorption attacks 



The assumption of fair sampling [13, 15, [29| that is 
considered to be reasonable for experiments constraining 
the possible models of Nature [l6|, is made invalid 
by the multiple-photon absorption attack: the sample 
of detected pulses does not represent fairly the pulses 
that are emitted. The fair sampling assumption becomes 
equivalent in this case to the assumption that under the 
conditions of use in an actual entanglement-based QKD, 
the detectors are actually sensitive to the single-photons 
received by Alice and Bob. 

As reasonable as this assumption might be in the ideal 
case, Alice and Bob would still need to be very careful 
to ensure that the imperfections in the various measur- 
ing devices are not compromising its validity in actual 
implementations of QKD protocols. 

Using frequency filters so that only a known range of 
restricted frequencies can reach the detectors is an ob- 
vious way to limit the possibility of multiple-photon ab- 
sorption in the ideal case. However, in actual implemen- 
tations of QKD protocols, Alice and Bob still need to 
guarantee that the dominant way to get a click in their 
necessarily imperfect detector is through a single-photon 
absorption, even at those frequencies allowed by the fil- 
ters. 

The energy diagram displayed on figure [3] is that of 
an ideal two-level system, so that the frequency at which 
a two-photon absorption occurs is exactly half that of 
a single-photon absorption. In a real detector however, 
where the energy levels are bound to be more compli- 
cated, photons with a frequency just slightly lower than 
ui could trigger a two-photon absorption if there exist 
other stable energy levels above |g). 

This issue becomes far more critical considering the 
existing faked-state attacks that have already been suc- 
cessfully implemented against QKD protocols 30|-32|, by 
forcing the detectors to exit the single-photon sensitive 
Geiger mode (sij . It is conceivable that this type of blind- 
ing attack could be tailored to allow only a multiple- 
photon absorption in the detectors used by Alice and 
Bob, at those precise frequencies that are permitted to go 
through. Such a combination of blinding detector attack 
together with our source designed for a multiple-photon 
absorption attack could then constitute a robust attack 
even against Ekert protocol, something that the blinding 
attack alone could not do |30| . 
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Testing the fairness of the sample 

An active method for Alice and Bob to detect Eve's at- 
tack, or to make sure that reducing the dark counts is not 
made at the cost of increasingly biasing the detection of 
signal pulses, would be to implement a fair sampling test 
[33| adapted to quantum key distribution with entangled 
states (3^. 

This fair sampling test does not introduce any loss and 
can be performed locally and unilaterally on either side 
during the production of the key. In a nutshell, it con- 
sists of analyzing the output channels of the measuring 
devices (here, the polarizing beam-splitters) instead of 
simply feeding detectors with them. The standard design 
of an entanglement-based QKD is kept intact, with two 
polarizing beam-splitters on each side (Alice and Bob) 
projecting the incoming pulses on random bases Ox and 
^B, as depicted on Fig. [H The novelty is to replace each 
detector by a polarimeter: a polarizing beam-splitter fol- 
lowed by a detector at each output. 

Consider Alice's side (see Fig. [6j). We label the po- 
larimeter in channel as Aq, the orientation of its po- 
larizing beam-splitter as ^Aqi and the detectors in the 
transmitted and reflected output as Aq" and A^ respec- 
tively. A click in either of these two detectors is treated 
as a click in channel 0. 

Similarly, the polarimeter in channel 1 is labeled Ai, 
the orientation of its polarizing beam-splitter (/:?Ai, and 
the detectors in the transmitted and reflected output are 
A.'^ and Aj" respectively. A click in either of these two 
detectors is treated as a click in channel 1. 

Bob would proceed similarly with two polarimeters la- 
beled Bo and Bi. 

Let us denote Po,+ the probability that a photon ini- 
tially polarized along A ends up in the + channel of po- 
larimeter Aq, that is, channel Aq". It is equal to the prob- 
ability Po(A,6>a) that this photon exits in the channel, 
multiplied by the probability that this same photon, im- 
pinging on polarimeter with an output polarization ^a, 
exits through the output channel +: 



cos^(A + Oa) cos^(6>a - ^Ao)- 



(24) 



Similarly, we have 

Po,- = cos2(A + ^a) sin2(^A - ^A,)^ (25) 

In the general case of a n-photon absorption, for a pulse 
containing exactly n photons all polarized along A, the 
probability that a multiple-photon absorption occurs in 
either channel of the polarimeter is equal to the proba- 
bility to that all photons exit in the same output channel 
Aq" plus the probability to that all photons exit in the 
same output channel A^, that is, (Po,+)^ + (Po,_)^. As 
usual, we have assumed that the photons are indepen- 
dent. 




FIG. 6. Fair Sampling test on Alice's side. The detector in 
channel is replaced by a polarimeter Aq with two detectors 
A J and A^. The detector in channel 1 is replaced by a po- 
larimeter Ai with two detectors A^ and Aj~. Ekert protocol 
is thus unaltered by the fair sampling test: polarimeter Ao 
is equivalent to the detector in channel in Fig. [1] and po- 
larimeter Ai is equivalent to the detector in channel 1. Bob 
would proceed similarly to test the fairness of the sampling 
on his side. 



To get the probability of a click in either channel of a 
polarimeter for our uniformly distributed source of po- 
larized pulses, we just need to average over all possible 
A: 



^0,FS — 



1 

2^ 



d\ cos^^(A + 6>a)- 



(cos2-(^A - ^Ao) + sin'"(^A -^Ao)). (26) 



and 



r)(n) 

1,FS 



= ^ / d\ sin2^(A + 6>A)- 
27r Jo 



(cos2^(^A - ^aJ + sin2^(^A - ^aJ), (27) 

Naturally, in the case of a single-photon absorption, 
for pulses containing exactly one photon, we get a prob- 
ability of detection in each polarimeter that is identically 
equal to \\ 



0,FS 



p(l) 
^1,FS 



(28) 



This illustrates the fact that in this single-photon absorp- 
tion case the sampling is fair. This is also the result that 
one would expect from a genuine source of entangled pho- 
tons: a photon impinging on a polarizing beam-splitter 
will be detected with probability 1 in either of the two 
output channels. 
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The faked-state attack 30|-32| consists of Eve imper- 
sonating Bob, intercepting the signal that is intended 
for him and using the exact same procedure that Bob 
would have implemented. In order to hide her presence, 
Eve's strategy consists of sending to Bob a signal that 
will deterministically give him the exact same measure- 
ment result as measured by Eve, but only in those cases 
in which Eve and Bob turned out to be performing their 
measurements in the same basis. In the remaining cases, 
when their bases are diagonal to each others. Eve's signal 
must not trigger any detection in any of Bob's detectors. 



FIG. 7. Probability of a click in a polarimeter (0 or 1) in the 
Fair Sampling test as a function of Oa — ^a- In the single- 
photon case, the probability of click in a polarimeter is in- 
dependent of the measurement settings: the sampling is fair. 
As soon however as Eve uses two-photon absorption in order 
to drive a violation of Bell inequalities in Alice's and Bob's 
detectors, they can spot the resulting unfairness of the sam- 
pling, due to the state-adaptivity of the attack, when Oa — ^a 
is varied (which is done automatically if LpA is fixed, and if Oa 
is varied randomly from pair to pair as is already the case in 
an entanglement-based QKD protocol). 



To implement this idea, Bob's detectors are blinded 
to single-photon detection by Eve. After each detection. 
Eve sends a signal that produces a click in one of Bob's 
detectors only when it is fully reflected or fully trans- 
mitted by its polarizing beamsplitter. So, whenever the 
bases chosen at random by Eve and Bob are diagonal 
with respect to each other, the signal sent by Eve is split 
in half at Bob's polarizing beamsplitter and is insufficient 
to produce a click in either detector. 



However, as soon as we consider a two-photon absorp- 
tion case, we obtain 

^O.FS = ^l.FS = ^ (3 + COS 4(^A - ^a)) , (29) 
and similarly in the three-photon absorption case, we get 

PSk = P[% = (5 + 3 cos 4(^A - ^a)) , (30) 

where ipx is either (/^Aq or if>x^ . 

The average probability to get a click in a polarimeter 
(0 or 1) becomes clearly dependent on the measurement 
setting 6>A and the polarimeter setting (^a)^ which betrays 
the state-adaptivity of the attack, and the resulting un- 
fair sampling (see FiglTj). 

Alice can perform this test locally, and unilaterally, 
in order to spot the unfairness of the sampling due to 
the state-adaptivity of Eve's attack. She only needs to 
compare the sum of single counts in the + and — output 
channel of a polarimeter when — is varied. She can 
do so by keeping the settings of her polarimeters fixed, for 
instance at = ^Aq = ^Ai = 0, while 6a is randomly 
switched from pair to pair, as is already the case in both 
Ekert and BBM92 protocol. Naturally, Bob can perform 
the test unilaterally and locally as well. 

Advantages of the Fair Sampling test against other 
attacks 

Note that the setup used for the Fair Sampling test 
would also make the other attacks against QKD protocols 
more complicated (if not impossible) to implement. 



This attack would however be immediately visible with 
our fair sampling test, because it would lead to double- 
clicks in the polarimeters. Locally, in the cases where Eve 
performs her measurement in the same basis Oa as Bob, 
everything would be fine when \(pA — Oa\ = 0, because 
the signal sent by Eve would entirely go to one detector 
only {Aq if Eve sent a 0, and if she sent a 1). But 
things would go wrong when \(pA — Oa\ = 7r/4 because 
then the signal sent by Eve would be split evenly inside 
the corresponding polarimeter {Aq if she sent a 0, or Ai if 
she sent a 1), so that no click would occur at all. If Eve 
tries to remedy this situation by increasing the signal, 
it would only result in both detectors in a polarimeter 
clicking at the same time (and then it would incidentally 
also lead to double-clicks when \(pA — Oa\ =0). So, the 
faked-state attack would fail in a fair sampling test setup 
because it would either lead to double-clicks or to no click 
at all when \(pA — ^a| = 7r/4. 

In the time-shift attack [35], when |(/?a — 6>a| = 7r/4 a 
photon exiting the PBS in a given channel z, would be 
dispatched randomly and with equal probability to ei- 
ther detector A'^ or detector A^ . It would thus become 
difficult, if not impossible, for Eve to adjust the time- 
shift associated to a specific polarimeter i. She would 
not have to deal with just one time-dependent detection 
pattern in each output channel z, but with two random 
ones, depending on whether a photon ends up in Af or 
in A~ . Note that this is reminiscent of the idea of ran- 
domly switching the bit assignments of the two detectors 
used in a standard protocol to eliminate the possibility 
of exploiting the detection efficiency mismatch [3^] . 
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CONCLUSION 

Contrary to all existing attacks on QKD protocols, the 
multiple-photon absorption attack does not require Eve 
to be physically located between Alice and Bob and to 
intercept anything that was intended for either of them, 
as in a typical intercept-and-resend attack 30|-S2|- The 
only requirement is that Eve has managed at some point 
in the past to replace the source of entangled state by her 
own mixture of separable states. She just needs to know 
the state A of each pulse and that is something that Eve 
could have set deterministically in the source. Once this 
is done, the security of the QKD protocol is compromised 
by anyone who happens to know the polarization of the 
pulses as a function of time X{t). 

By mimicking the statistics of an entangled state well 
enough to pass the security checks normally undertaken 
by Alice and Bob, the attack can in principle work 
against any entanglement-based quantum key distribu- 
tion protocol. The attack works in particular for both 
Ekert and BMM92 protocols, independently of which 
protocol is chosen by Alice and Bob. 

While there already exist explicit attacks on the 
BBM92 protocol [sil. El, E^, to our knowledge the 
multiple-photon absorption attack is in fact the only ex- 
plicit attack against Ekert protocol with light sources. 

As long as a device-independent quantum key distri- 
bution [19', '20^ is beyond technological reach [sHI, [36| , it is 
therefore fundamental for Alice and Bob to either prevent 
altogether the possibility of multiple-photon absorptions 
in their detectors, or to include a fair sampling test in 
the protocol to be able to detect such an attack. The 
fair sampling test can be performed unilaterally on ei- 
ther side without introducing any loss, and it should also 
make the task more complicated if not impossible for 
other existing attacks on QKD protocols. 

Irina Basieva is supported by a grant from the Swedish 
Institute. 
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